IBAN country differs from VAT country

If a check reported that the VAT number is registered in one country and the IBAN was issued in another, the first thing to know is that this is common and entirely legal. The second is that it is worth thirty seconds of attention.

Why it is usually nothing

Within SEPA, a euro payment to an account in another member state costs the same and takes the same time as a domestic one. There is no reason for a business to hold an account in every country it invoices from, and plenty of reasons not to. Ordinary explanations include:

• Group banking. A subsidiary invoices under its local VAT registration while the group collects centrally, often in the Netherlands, Ireland or Luxembourg.
• Payment providers. Wise, Revolut, Stripe, Mollie and Airwallex issue accounts where they are licensed, not where the customer is. A Belgian or Lithuanian IBAN on an invoice from anywhere in Europe usually means one of these.
• Factoring. The supplier has sold the receivable, and the invoice legitimately directs payment to the factoring company’s account, frequently abroad.
• The business genuinely moved its banking and has not mentioned it, because from their side nothing about it is remarkable.

None of these is a warning sign, which is exactly why this tool does not present the difference as one. A check that flagged every cross-border IBAN would fire on a large share of honest European invoices, and a warning that is usually wrong is a warning people learn to click past.

Why it is still worth a look

The fraud this matters for is not a fake company. It is a real supplier, one you have paid before, whose email account was compromised — and the only thing that changed on the invoice is the bank account. Their VAT number is still valid. Their domain still passes every email authentication check. Nothing a single-purpose checker looks at has changed, because nothing about the supplier changed.

What changed is the relationship between two facts: who they are, and where the money now goes. That is the difference this check reports, and it is the reason the tool runs registry and bank checks together rather than one at a time.

The question to ask

You do not need to interrogate anyone. On the call you are making anyway to confirm the bank details — using a number from an earlier invoice or your own records, never one from the email in front of you — ask:

“Has your bank account changed since the last invoice?”

If the answer is no and the IBAN in front of you is not the one you paid last time, stop and escalate. If the answer is yes, ask them to say the account country and the last four digits out loud, and check that against what you have.

What it does not tell you

A matching country is not reassurance. An attacker who wants the transfer to look right can open an account in the supplier’s own country, and plenty do. The countries agreeing means one specific oddity is absent, nothing more.

Equally, this comparison only runs when the VAT number was confirmed by the registry and the IBAN passed its checksum. If either was missing, unavailable or invalid, the check has nothing to compare and says nothing at all — rather than guessing.